Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
14-10-2022 16:15
Static task
static1
Behavioral task
behavioral1
Sample
IData.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
IData.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
obediences/bide.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
obediences/bide.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
obediences/salient.dll
Resource
win7-20220901-en
windows7-x64
General
-
Target
obediences/salient.dll
-
Size
295KB
-
MD5
11c4d79864a389a5400a92fbc4b3e80a
-
SHA1
e299a44aa3dbebfe62410ff5fda226d1d3f74ef2
-
SHA256
57108d6e8e86f1a416f5ac44ccd49f2b58cbc9e3995fc35fec4a43fd700fa39e
-
SHA512
4862ac69e86ca1293886081546f9d3cec9f20dc495081fe6aaea418502ef223b673c588a46b0609b93180e8682f91a56e8f0435e2c6c8c61e229fc360939f639
-
SSDEEP
6144:YiSz8ZFZG2MEnD4vrWEBvljmcmUv9n2dDSH+:DS4HMmQWEBvlaUqSH+
Malware Config
Extracted
qakbot
403.973
BB01
1665647855
19.168.189.106:26139
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 988 regsvr32.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe 1148 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 988 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 1768 wrote to memory of 988 1768 regsvr32.exe 27 PID 988 wrote to memory of 1148 988 regsvr32.exe 28 PID 988 wrote to memory of 1148 988 regsvr32.exe 28 PID 988 wrote to memory of 1148 988 regsvr32.exe 28 PID 988 wrote to memory of 1148 988 regsvr32.exe 28 PID 988 wrote to memory of 1148 988 regsvr32.exe 28 PID 988 wrote to memory of 1148 988 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\obediences\salient.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\obediences\salient.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148
-
-